Self-Assessment Against DORA

Self-assessment against DORA is a structured review by an EU firm of its own arrangements against Regulation (EU) 2022/2554, the digital operational resilience regulation, which applies from 17 January 2025. The firm works through the regulation's expectations, service by service, and records for each one what it does, what evidence supports that, and where it falls short. The result should be an honest map of strengths and gaps, owned and dated, that the firm can use to improve and can show to an auditor or supervisor when asked.

This guide concerns DORA only. The UK regime, set by the FCA and PRA policy statements, has its own expectations and its own dates, and it is covered in the companion guide for UK rules. Keeping the two assessments separate matters, because a firm that blends them will answer neither regime well and may miss an expectation that exists in one regime but not the other. Where a firm operates under both regimes, it needs two assessments, even if some underlying evidence serves both.

A DORA self-assessment starts with scope, and scope starts with services. The firm should list the services and functions within DORA's reach for its own business, identify which are important, and map their dependencies, including third party suppliers of information and communication technology services. Without that service picture, an assessment of controls will float free of the operations it is supposed to protect, and its conclusions will be difficult to act on.

Each area should be judged against the regulation's expectation and against the firm's own evidence, not against its intentions. The assessor should ask what the firm actually does, what record shows that it does it, and whether the record covers the services in scope. A policy that has never been tested, a test that never exercised the relevant dependency, and an incident process that has never been used in a real event are all weaker than their descriptions suggest, and the assessment should say so plainly.

Judgements should be graded honestly, with room for partial compliance and for areas where the firm is still building its arrangements. A self-assessment that rates everything as satisfactory tells the reader nothing, and it deprives the firm of the prioritised list of gaps that is the assessment's main product. The most useful assessments are those in which the firm is hardest on itself about the services and dependencies that matter most, because those are the areas where a gap carries the greatest risk.

The assessment should be traceable to evidence. Each judgement should point to the record behind it: the map, the tolerance, the test record, the incident review, or the supplier arrangement concerned. That traceability serves two purposes. It lets a later reader, including an auditor or supervisor, check the judgement without retaking the assessor's word for it, and it lets the firm itself revisit the judgement when the underlying evidence changes, rather than starting the assessment again from scratch.

Gaps found in self-assessment need owners, dates, and a place in the service trail where their closure will be recorded. The action list should be prioritised by risk to important services, not by ease of closure, and it should distinguish between quick fixes, such as completing a missing record, and deeper work, such as retesting a dependency or renegotiating a supplier arrangement. Each action should be specific enough that a later reviewer can tell whether it has been completed, without asking the owner for an interpretation.

A DORA self-assessment is a living record, not a one-off project. It should be revisited when a service changes, when a supplier changes, when a test or incident reveals something new, and when the regulatory picture changes, including new technical standards or guidance from the European supervisory authorities. Each revisit should update only the judgements affected, preserving the earlier version so that the firm can show how its position has changed over time.

Keeping the assessment current also means keeping it separate from the UK assessment where both apply, and labelling every judgement by regime. A firm that maintains two clean, dated assessments, each traceable to evidence, is in a far stronger position than a firm with one blended document that cannot answer a regime-specific question. The discipline is small, but it is the difference between an assessment that can be shown and an assessment that must be explained away.